Members

Two kinds of membership

Internal. An address in a verified organization domain. The organization controls the account: it sees the member, can remove them, and takes access away in the same move.

External. A contractor, partner or customer with an outside address. The organization does not become the owner of their account — it only gains the right to let them into its applications. Their personal addresses, keys and other sites stay theirs.

The distinction matters: removing an external member takes away access to the organization's applications and nothing else.

How people join

There are no invitations. A person presses "Sign in with auth.my" on your site, and then:

• an address in an organization domain makes them an employee at once;
• an outside address is checked against whether the organization accepts external members, and if so a joining screen shows the full list of domains in the group.

If the organization does not accept external members, or the address fails the domain filter, sign-in to its application is refused.

Admission by request

An organization that accepts external members can still decide each case itself. In that mode consent from the person opens nothing: it creates a request, and they become a member when an administrator accepts it in the organization console. The applicant is told by email either way.

The rules are checked again at the moment of the decision, not at the moment of the request. An organization that stopped accepting outsiders while a request was waiting cannot let one in by accident.

Employees-only applications

A client can be restricted so that only members of the owning organization may sign in.

The check runs on every sign-in, not once when consent was given. An employee removed yesterday cannot sign in today, even if consent was granted six months ago.

Your site sees a refusal with the code not_in_organization.

Domain filter

An organization that accepts external members can limit their domains — only partner.com, for example. An address outside the list is refused on the same screen.

What your site sees

Nothing special: the same sub, the same email. Organization membership is a question of admission, not of profile data. If the application is restricted to an organization, a successful sign-in already means the person is a member.